312-50 Question 326
Single answer▪ Attack Session Management MechanismDuring an authorized internal penetration test, you compromise a Linux web server and use Metasploit to obtain a Meterpreter session. The target environment is unstable, and the blue team may reboot the host at any time. You need to keep access organized, avoid losing track of active footholds, and be able to interact with the compromised host later without immediately running new exploits. Which Metasploit capability best supports this requirement?
- A
Use Metasploit's session management commands to list, background, rename, and interact with active sessions
- B
Run a TCP port scan from the Meterpreter shell before interacting further so the session remains persistent
- C
Export the exploit module configuration, because module settings automatically restore the compromised session after a reboot
- D
Clear the target's event logs so the existing Meterpreter session is preserved in memory
Show answer and explanation
Correct answer: A
Explanation
In CEH-relevant post-exploitation workflows, attack session management refers to controlling and organizing active access channels established after exploitation. In Metasploit, this is commonly done through the framework's session management features, such as listing active sessions, backgrounding one session to use other modules, and later reattaching to the same session. This is different from persistence, which is used to regain access after a reboot or logoff, and different from anti-forensics, which attempts to reduce traces. Metasploit documentation and operator practice distinguish these areas clearly: session management handles live connections; persistence mechanisms are separate and must be intentionally deployed where authorized; and reconnaissance or log tampering do not inherently maintain a session. Therefore, the best answer is the use of Metasploit's session management capabilities.
- A. Correct.
Correct. Metasploit's attack session management mechanism is designed to manage compromised hosts after exploitation. In practice, this includes viewing sessions with commands such as 'sessions', interacting with a specific session, and backgrounding an active Meterpreter session so you can continue working in the framework without terminating access. Renaming or otherwise organizing sessions also helps when multiple footholds exist. This directly addresses the need to keep access organized and return to an existing session later during the engagement.
- B. Incorrect.
Incorrect. Running a port scan may provide additional reconnaissance, but it does not manage the existing attack session or improve persistence. A Meterpreter session remains active based on process state, network connectivity, and host stability, not because additional scanning is performed. This option reflects a common misconception that post-exploitation activity somehow strengthens session retention.
- C. Incorrect.
Incorrect. Exporting or saving module configuration can help reproduce how an exploit was launched, but it does not restore an already established session after the host reboots. If the target restarts and no persistence mechanism has been deployed, the original Meterpreter process and its session are typically lost. Session management and persistence are related but distinct concepts.
- D. Incorrect.
Incorrect. Clearing logs is an anti-forensics action and does not preserve a Meterpreter session. The session exists because of a live payload process and network channel. If the process dies or the machine reboots, the session ends regardless of log state. Candidates may choose this because they confuse stealth measures with session management.